File fix_unconfinedprivs.patch of Package selinux-policy

Overview Repositories Revisions Requests Users Attributes Meta

File fix_unconfinedprivs.patch of Package selinux-policy (Revision 3142413fbdfb5fd87a48108c7c6d5718)

Currently displaying revision 3142413fbdfb5fd87a48108c7c6d5718 , Show latest

diff --git a/config/appconfig-mcs/default_contexts b/config/appconfig-mcs/default_contexts
index 698d54ce8..c415a541d 100644
--- a/config/appconfig-mcs/default_contexts
+++ b/config/appconfig-mcs/default_contexts
@@ -13,3 +13,6 @@ sysadm_r:sysadm_sudo_t:s0	sysadm_r:sysadm_t:s0
 
 user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
+
+unconfined_r:unconfined_su_t:s0		unconfined_r:unconfined_t:s0 system_r:sysadm_t:s0
+unconfined_r:unconfined_sudo_t:s0	system_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
diff --git a/config/appconfig-mls/default_contexts b/config/appconfig-mls/default_contexts
index 698d54ce8..c415a541d 100644
--- a/config/appconfig-mls/default_contexts
+++ b/config/appconfig-mls/default_contexts
@@ -13,3 +13,6 @@ sysadm_r:sysadm_sudo_t:s0	sysadm_r:sysadm_t:s0
 
 user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
+
+unconfined_r:unconfined_su_t:s0		unconfined_r:unconfined_t:s0 system_r:sysadm_t:s0
+unconfined_r:unconfined_sudo_t:s0	system_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
diff --git a/config/appconfig-standard/default_contexts b/config/appconfig-standard/default_contexts
index 25ee341c1..7ee18dd31 100644
--- a/config/appconfig-standard/default_contexts
+++ b/config/appconfig-standard/default_contexts
@@ -13,3 +13,6 @@ sysadm_r:sysadm_sudo_t	sysadm_r:sysadm_t
 
 user_r:user_su_t	user_r:user_t staff_r:staff_t sysadm_r:sysadm_t
 user_r:user_sudo_t	sysadm_r:sysadm_t user_r:user_t
+
+unconfined_r:unconfined_su_t	unconfined_r:unconfined_t system_r:sysadm_t
+unconfined_r:unconfined_sudo_t	system_r:sysadm_t unconfined_r:unconfined_t
diff --git a/policy/mcs b/policy/mcs
index ba9e2ee16..befddb553 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -4,9 +4,10 @@ default_range dir_file_class_set target low;
 #
 # Define sensitivities 
 #
-# MCS is single-sensitivity.
+# Domination of sensitivities is in increasing
+# numerical order, with s0 being the lowest
 
-gen_sens(1)
+gen_sens(mls_num_sens)
 
 #
 # Define the categories
@@ -19,8 +20,10 @@ gen_cats(mcs_num_cats)
 # Each MCS level specifies a sensitivity and zero or more categories which may
 # be associated with that sensitivity.
 #
+# Generate levels from all sensitivities
+# with all categories
 
-gen_levels(1,mcs_num_cats)
+gen_levels(mls_num_sens,mcs_num_cats)
 
 #
 # Define the MCS policy
@@ -71,13 +74,13 @@ gen_levels(1,mcs_num_cats)
 #  - /proc/pid operations are not constrained.
 
 mlsconstrain file { read ioctl lock execute execute_no_trans }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain file { write setattr append unlink link rename }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { search read ioctl lock }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
@@ -86,7 +89,7 @@ mlsconstrain fifo_file { open }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 30f89d3a6..fb3eca32f 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -1775,8 +1775,6 @@ interface(`domain_unconfined',`
 	typeattribute $1 process_uncond_exempt;
 
 	mcs_process_set_categories($1)
-
-	userdom_filetrans_home_content($1)
 ')
 
 ########################################
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 7cd451854..0b2eb009b 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -247,10 +247,10 @@ fs_associate_tmpfs(tmpfsfile)
 #
 
 # Create/access any file in a labeled filesystem;
-allow files_unconfined_type file_type:{ file chr_file } ~{ execmod entrypoint };
-allow files_unconfined_type file_type:dir ~map;
-allow files_unconfined_type file_type:{ lnk_file sock_file fifo_file blk_file } *;
-allow files_unconfined_type file_type:service *;
+allow files_unconfined_type non_auth_file_type:{ file chr_file } { execute_no_trans execmod };
+allow files_unconfined_type non_auth_file_type:file_class_set { manage_file_perms execute };
+allow files_unconfined_type non_auth_file_type:dir manage_dir_perms;
+allow files_unconfined_type non_auth_file_type:service manage_service_perms;
 
 # Mount/unmount any filesystem with the context= option.
 allow files_unconfined_type file_type:filesystem all_filesystem_perms;
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 7e783399c..4f476e713 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -359,6 +359,5 @@ allow filesystem_unconfined_type filesystem_type:filesystem all_filesystem_perms
 # Create/access other files. fs_type is to pick up various
 # pseudo filesystem types that are applied to both the filesystem
 # and its files.
-allow filesystem_unconfined_type filesystem_type:{ file } ~entrypoint;
-allow filesystem_unconfined_type filesystem_type:dir ~map;
-allow filesystem_unconfined_type filesystem_type:{ lnk_file sock_file fifo_file chr_file blk_file } *;
+allow filesystem_unconfined_type filesystem_type:{ file dir lnk_file sock_file fifo_file chr_file blk_file } { getattr ioctl lock open read };
+allow filesystem_unconfined_type filesystem_type:{ dir } { search watch };
diff --git a/policy/modules/kernel/selinux.te b/policy/modules/kernel/selinux.te
index 7d3e431ee..01dec0ff1 100644
--- a/policy/modules/kernel/selinux.te
+++ b/policy/modules/kernel/selinux.te
@@ -61,28 +61,28 @@ ifdef(`distro_rhel4',`
 ')
 
 if(!secure_mode_policyload) {
-	allow can_setenforce security_t:security setenforce;
-	dev_getattr_sysfs_fs(can_setenforce)
-	dev_search_sysfs(can_setenforce)
-	allow can_setenforce security_t:dir list_dir_perms;
-	allow can_setenforce security_t:file rw_file_perms;
+	allow { can_setenforce -selinux_unconfined_type } security_t:security setenforce;
+	dev_getattr_sysfs_fs({ can_setenforce -selinux_unconfined_type })
+	dev_search_sysfs({ can_setenforce -selinux_unconfined_type })
+	allow { can_setenforce -selinux_unconfined_type } security_t:dir list_dir_perms;
+	allow { can_setenforce -selinux_unconfined_type } security_t:file rw_file_perms;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_setenforce security_t:security setenforce;
+		auditallow { can_setenforce -selinux_unconfined_type } security_t:security setenforce;
 	')
 
-	allow can_load_policy security_t:security load_policy;
+	allow { can_load_policy -selinux_unconfined_type } security_t:security load_policy;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_load_policy security_t:security load_policy;
+		auditallow { can_load_policy -selinux_unconfined_type } security_t:security load_policy;
 	')
 
-	allow can_setbool boolean_type:security setbool;
+	allow { can_setbool -selinux_unconfined_type } boolean_type:security setbool;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_setbool boolean_type:security setbool;
+		auditallow { can_setbool -selinux_unconfined_type } boolean_type:security setbool;
 	')
 }
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index b77f83d94..d33f766c7 100644
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -99,7 +99,14 @@ ssh_dyntransition_to(unconfined_t)
 
 unconfined_domain_noaudit(unconfined_t)
 domain_named_filetrans(unconfined_t)
-domain_transition_all(unconfined_t)
+
+optional_policy(`
+	su_role_template(unconfined, unconfined_r, unconfined_t)
+')
+
+optional_policy(`
+	sudo_role_template(unconfined, unconfined_r, unconfined_t)
+')
 
 usermanage_run_passwd(unconfined_t, unconfined_r)
 
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index b5490205a..f1af9f080 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1949,6 +1949,7 @@ role system_r types daemon;
 #')
 
 allow initrc_domain daemon:process transition;
+allow initrc_domain daemon:process2 { nnp_transition nosuid_transition };
 allow daemon initrc_domain:fd use;
 allow daemon initrc_domain:fifo_file rw_inherited_fifo_file_perms;
 allow daemon initrc_domain:process sigchld;
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
index f6ada7d06..e43fff580 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -25,6 +25,7 @@ interface(`unconfined_domain_noaudit',`
 
 	# Transition to myself, to make get_ordered_context_list happy.
 	allow $1 self:process { dyntransition transition };
+	allow $1 self:process2 { nnp_transition nosuid_transition };
 
 	# Write access is for setting attributes under /proc/self/attr.
 	allow $1 self:file manage_file_perms;
@@ -39,6 +40,9 @@ interface(`unconfined_domain_noaudit',`
 	allow $1 self:association all_association_perms;
 	allow $1 self:socket_class_set create_socket_perms;
 
+	mls_rangetrans_target($1)
+	mcs_constrained($1)
+
 	kernel_unconfined($1)
 	corenet_unconfined($1)
 	dev_unconfined($1)

Places

File fix_unconfinedprivs.patch of Package selinux-policy (Revision 3142413fbdfb5fd87a48108c7c6d5718)

Places